feat(web): engagement wizard, model/auth picker, Auth & Keys menu, attack-path graph

Full frontend rewrite following a deliberate visual direction (dense
security-operations console — borders over shadows, two radii, one accent,
no gradients/glassmorphism) and fixing real bugs found in review:

- EventSource on the exploit stream never called es.close() on 'done',
  so the browser silently reconnected and re-streamed the whole job
  (duplicate log lines/findings). Fixed.
- Sidebar 'running' step indicator and openRun() matched ANY running run
  instead of the one belonging to the current job (by runId). Fixed.

New:
- 5-step engagement wizard (Asset -> Scope & Auth -> Leads -> Model & Run
  -> Review) replacing the single flat board — inspired by the
  Discovery/Plan/Exploit/Remediate stage model both a.security and
  terra.security use publicly.
- Model is now a real dropdown sourced from /api/providers (mirrors
  harness::models::providers()), with an API-key vs. subscription toggle
  that disables subscription for API-only providers.
- One Auth & Keys menu: target auth header + named roles (IDOR/BOLA/BFLA
  multi-identity testing) materialize into an ephemeral creds.yaml passed
  via --creds; per-provider API keys live in server memory only (never on
  disk) and are merged into every spawned child's env.
- Generative Attack Path Chaining: findings rendered as kill-chain columns
  (recon -> initial-access -> ... -> impact) with chains_from resolved to
  parent titles, live in the run view and static in run detail.
- Findings are now a proper table (severity/title/endpoint/CWE/agent/
  confidence) instead of stacked cards.
- Explicit light/dark theme toggle persisted in localStorage, defaulting
  to light (previously light only won when the OS wasn't in dark mode).
- All UI strings in English.

Backend additions: GET /api/providers, GET/POST/DELETE /api/keys,
ephemeral creds.yaml generation for auth/roles, env override merged into
every exploit-job and REPL child spawn.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

web/API.md

@@ -52,6 +52,40 @@ An agent's `id`/`name` is exactly what the CLI's `--only <name>` flag expects (s
 
 ---
 
+## Providers / models / API keys
+
+### `GET /api/providers`
+
+Static mirror of `crates/harness/src/models.rs` `providers()` — every provider the harness
+supports, its models, and whether it's usable via a local CLI subscription login (`kind: "cli"`)
+or API key only (`kind: "api"`).
+
+```json
+[ { "key": "anthropic", "label": "Anthropic Claude", "kind": "cli", "models": ["claude-opus-5", "..."] } ]
+```
+
+### `GET /api/keys`
+
+Which providers currently have an API key set **in this server process's memory** (booleans only
+— never the value):
+
+```json
+[ { "provider": "anthropic", "set": true }, { "provider": "openai", "set": false } ]
+```
+
+### `POST /api/keys`
+
+Body `{ "provider": "anthropic", "key": "sk-..." }`. Stores the key in an in-memory `Map` —
+**never written to disk**, lost on server restart. Every subsequent `/api/exploit` and `/api/repl`
+child process is spawned with `<provider>.envKey` set from this store (merged over `process.env`).
+Omitting `key` (or passing an empty string) clears it. 400 on an unknown provider.
+
+### `DELETE /api/keys/:provider`
+
+Clears one provider's key.
+
+---
+
 ## Runs (history)
 
 ### `GET /api/runs`
@@ -106,10 +140,20 @@ Body:
   "focus": "injection and business logic",   // --focus
   "objective": "pre-launch review of checkout",  // --objective
   "outOfScope": "staging.example.com",           // --out-of-scope
-  "agents": ["sqli_error", "idor"]  // --only <name>, repeated — the lead-board selection
+  "agents": ["sqli_error", "idor"],  // --only <name>, repeated — the lead-board selection
+  "auth": "Authorization: Bearer <token>",  // target auth header — see Target auth below
+  "roles": [{ "name": "admin", "header": "Authorization: Bearer ..." }],  // multi-identity access-control testing
 }
 ```
 
+### Target auth (`auth` / `roles`)
+
+If `creds` is omitted and either `auth` or `roles` is set, the server writes a minimal
+`creds.yaml`-compatible file (matching `neurosploit-rs/creds.example.yaml`'s schema) to
+`os.tmpdir()/neurosploit-web/<job-id>.creds.yaml` and passes it via `--creds`. An explicit `creds`
+path always wins over `auth`/`roles`. These ephemeral files are not cleaned up automatically —
+they live in the OS temp dir, never in the repo.
+
 Response: `{ "id": "<job-uuid>" }`. This `id` is the **web job id**, not the run id — the CLI's own
 `ns-<timestamp>-<target>` run id is discovered from its own log line and exposed as `runId` in the
 job snapshot once the engagement starts writing to `runs/`.